Detections
Analytics

1.281 ALMA-09-035990

Information

AlmaLinux OS 9 must ensure the password complexity module in the system-auth file is configured for three retries or less.

GROUP ID: V-269387
RULE ID: SV-269387r1050270

AlmaLinux OS 9 uses "pwquality" as a mechanism to enforce password complexity. This is set in both:
/etc/pam.d/password-auth
/etc/pam.d/system-auth

By limiting the number of attempts to meet the pwquality module complexity requirements before returning with an error, the system will audit abnormal attempts at password changes.

Solution

Configure AlmaLinux OS 9 to limit the "pwquality" retry option to "3".

Add the following line to the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files (or modify the line to have the required value):

password required pam_pwquality.so retry=3

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1), CCI|CCI-004066, Rule-ID|SV-269387r1050270_rule, STIG-ID|ALMA-09-035990, Vuln-ID|V-269387

Plugin: Unix

Control ID: ade5b08fe352a9b3d3c848136527ae4c4e16e7a4dee1bfb143797ca4322f5655